Subject: [sipcore] Session-timer: Result below an acceptable value

From: OKUMURA Shinji <[email-masked]>
Date: Thu, 4 Oct 2018 16:19:05 +0900

Hi,

As I said before, there is another problem in acurrent RFC
that the proxy will receive SE result below an acceptable value.
Because UAS can reduce SE-value below an acceptable one.

RFC says in 8.1
   A proxy MUST NOT insert a Min-SE header
   field or modify the value of an existing header field in a proxied
   request if that request contains a Supported header field with the
   value 'timer'.  This is needed to protect against certain denial of
   service attacks, described in Section 11.

I've read Section 11, but I don't understand the need.

To solve this problem, a proxy need to increase the Min-SE in a request.

Regards,
Shinji

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 4 Oct 2018 07:47:20 +0000

Hi,

I am not sure I understand the issue.

I don't think a proxy should lover the Min-SE value.

Now, if the UA for whatever reason includes a very large Min-SE value, and the proxy wants a lower value, I think the proxy should reject the request. Perhaps we'd need a new response code for that.

Regards,

Christer

________________________________
From: sipcore <[email-masked]> on behalf of OKUMURA Shinji <[email-masked]>
Sent: Thursday, October 4, 2018 10:19 AM
To: [email-masked]
Subject: [sipcore] Session-timer: Result below an acceptable value

Hi,

RFC says in 8.1

Regards,
Shinji

_______________________________________________
sipcore mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sipcore
sipcore Info Page - IETF<https://www.ietf.org/mailman/listinfo/sipcore>
www.ietf.org
The Session Initiation Protocol Core (SIPCore) working group is chartered to maintain and continue the development of the core SIP specifications, currently defined ...

---

From: OKUMURA Shinji <[email-masked]>
Date: Thu, 4 Oct 2018 18:08:55 +0900

Hi Christer,

If the UAC includes a very large Min-SE value, and the proxy wants a lower value,
there is no ploblem.

1. UAC sends SE: 1800/Min-SE: 900
2. Proxy desires results of 1200 to 1800. 1800 is acceptable, proxy forwards it without any changes.
3. UAS returns SE: 900

The simplest solution is that proxy increase Min-SE to 1200.
Do you know the reason why a proxy MUST neither insert  nor modify a Min-SE header?

Regards,
Shinji

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 4 Oct 2018 09:32:08 +0000

Hi,

Sorry, I read your first e-mail wrong: I thought you said that the proxy would DECREASE Min-SE. But, now I see that you talk about INCREASE 😊

I see no reason why a proxy couldn't increase Min-SE.

As we have learned, the main users of session timer are proxies, not UAs, so a UA should not care if the minimum value is increased.

Regards,

Christer

________________________________
From: OKUMURA Shinji <[email-masked]>
Sent: Thursday, October 4, 2018 12:08 PM
To: [email-masked]
Cc: Christer Holmberg
Subject: Re: [sipcore] Session-timer: Result below an acceptable value

Hi Christer,

Regards,
Shinji

> www.ietf.org<http://www.ietf.org>

---

From: Roman Shpount <[email-masked]>
Date: Thu, 4 Oct 2018 07:29:02 -0400

On Thu, Oct 4, 2018 at 5:32 AM Christer Holmberg <
[email-masked]> wrote:

> Sorry, I read your first e-mail wrong: I thought you said that the proxy
> would DECREASE Min-SE. But, now I see that you talk about INCREASE 😊
>
>
> As we have learned, the main users of session timer are proxies, not UAs,
> so a UA should not care if the minimum value is increased.
>

Technically speaking UA still care about how often they need to generate
refresh since this can result in extra load on the UA. When session timer
is negotiated, S-E specifies the max acceptable value and Min-SE specifies
min acceptable value, so proxy should be able to increase Min-SE and
decrease SE. At the end, session timer is negotiated at the maximum
acceptable value, which is specified in SE.

Regards,
_____________
Roman Shpount

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 4 Oct 2018 11:43:19 +0000

Hi,

>Technically speaking UA still care about how often they need to generate refresh since this can result in extra load on the UA.

Sure, but increasing the Min-SE value will not result in extra load - on the contrary it may reduce load :)

>When session timer is negotiated, S-E specifies the max acceptable value and Min-SE specifies min acceptable value, so proxy should be able to increase Min-SE and decrease SE.

Correct.

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 4 Oct 2018 12:05:42 +0000

Hi,

In order to keep track of the suggested RFC modifications, I suggest that we create GitHub issues.

As an example, I created one for Shinji's suggestion to allow a proxy to increase the Min-SE header field value.

https://github.com/cdh4u/draft-sessiontimer-race/issues/1

(As always, any formal decision whether to modify something will be made on the list)

Regards,

Christer

________________________________
From: sipcore <[email-masked]> on behalf of Christer Holmberg <[email-masked]>
Sent: Thursday, October 4, 2018 2:43 PM
To: Roman Shpount
Cc: OKUMURA Shinji; SIPCORE
Subject: Re: [sipcore] Session-timer: Result below an acceptable value

Hi,

Correct.

Regards,

Christer

---

From: [email-masked]
Date: Thu, 04 Oct 2018 21:21:08 +0800

Hi
Reading this. I understand that the proxy should be allowed to increase the Min SE.

For my understanding.

Following that the UAS cannot lower it again. Correct?

That would be my understanding.

Best Regards

Roland

Am 04.10.2018 20:05 schrieb Christer Holmberg <[email-masked]>:

Hi,

Regards,

Christer

To: Roman Shpount

Hi,

Sorry, I read your first e-mail wrong: I thought you said that the proxy would DECREASE Min-SE. But, now I see that you talk about INCREASE
😊

Correct.

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 4 Oct 2018 13:33:56 +0000

Hi,

The UAS is not allowed to include Min-SE to begin with (unless it sends a 422 response).

The UAS is currently allowed to reduce the S-E value in the response, as long as it it's larger than the Min-SE value in the corresponding request. My suggestion would be to say that a UAS SHOULD NOT reduce the S-E. Again, assuming the proxies know better how often they want session refreshes, there is no need for the UAS to reduce the value.

Regards,

Christer

________________________________
From: [email-masked] <[email-masked]>
Sent: Thursday, October 4, 2018 4:21 PM
To: Christer Holmberg
Cc: Roman Shpount; OKUMURA Shinji; SIPCORE
Subject: Re: [sipcore] Session-timer: Result below an acceptable value

Hi

Best Regards
Roland

Hi,

[https://avatars0.githubusercontent.com/u/9333380?s=400&v=4]<https://github.com/cdh4u/draft-sessiontimer-race/issues/1>

Proxy allowed to increase Min-SE header field value · Issue #1 · cdh4u/draft-sessiontimer-race<https://github.com/cdh4u/draft-sessiontimer-race/issues/1>
github.com
BACKGROUND: Section 8.1 of RFC 4028 says: "A proxy MUST NOT insert a Min-SE header field or modify the value of an existing header field in a proxied request if that request contains a Support...

Regards,

Christer

Hi,

Correct.

Regards,

Christer

---

From: OKUMURA Shinji <[email-masked]>
Date: Sat, 6 Oct 2018 16:50:56 +0900

Hi,

If a proxy decreases the S-E, the next proxy is more likely to reject
the request by 422.
So I think that a proxy should adjust the Min-SE rather than decrease
the S-E.
And ultimately, a UAS should decrease the S-E as low as possible after
considering it's own wishes.

Regards,
Shinji

---

From: Paul Kyzivat <[email-masked]>
Date: Sat, 6 Oct 2018 13:17:58 -0400

> considering it's own wishes.

There is an inherent conflict here: those elements (presumably proxies) 
that need the timer for tracking session state (e.g. for billing) may 
want a small S-E value to improve precision. The other elements (notably 
the UAs) that don't *need* it want the value as large as possible in 
order to reduce their load. The negotiation of S-E and Min-SE is 
intended to seek a compromise between these. But there is no guarantee 
that there is an acceptable compromise. Somebody may decide there is no 
acceptable value and reject the session. I see no "solution" to this.

	Thanks,
	Paul

---

From: Christer Holmberg <[email-masked]>
Date: Sat, 6 Oct 2018 19:20:52 +0000

Hi,

I don't think the UAS should decrease S-E. Again, the mechanism is mostly useful for proxies, so they should be able to decide.

Of course, if the UAS think the S-E value is too LOW, it should reject the request. But, I see no reason why a UAS should decrease the value.

Regards,

Christer

________________________________
From: OKUMURA Shinji <[email-masked]>
Sent: Saturday, October 6, 2018 10:50 AM
To: SIPCORE
Cc: Christer Holmberg; [email-masked]; Roman Shpount
Subject: Re: [sipcore] Session-timer: Result below an acceptable value

Hi,

Regards,
Shinji

---

From: Roman Shpount <[email-masked]>
Date: Sat, 6 Oct 2018 18:31:54 -0400

On Sat, Oct 6, 2018 at 3:20 PM Christer Holmberg <
[email-masked]> wrote:

> I don't think the UAS should decrease S-E. Again, the mechanism is mostly
> useful for proxies, so they should be able to decide.
>
>
> Of course, if the UAS think the S-E value is too LOW, it should reject the
> request. But, I see no reason why a UAS should decrease the value.
>

Some UA are one side of B2BUA which they act almost as proxies which do
some, not allowed for proxies header modifications. Such B2BUA do use
session timer for state maintenance. So, there are valid reasons for UA to
state and to decrease the S-E expires value.

Regards,
_____________
Roman Shpount

---

From: Christer Holmberg <[email-masked]>
Date: Sun, 7 Oct 2018 19:18:58 +0000

Fair enough, but I still think it would be good to have text saying that a UAS should not decrease the value unless it has a really good reason for doing so.

Regards,

Christer

________________________________
From: Roman Shpount <[email-masked]>
Sent: Sunday, October 7, 2018 1:31 AM
To: Christer Holmberg
Cc: OKUMURA Shinji; SIPCORE; [email-masked]
Subject: Re: [sipcore] Session-timer: Result below an acceptable value

On Sat, Oct 6, 2018 at 3:20 PM Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:

Some UA are one side of B2BUA which they act almost as proxies which do some, not allowed for proxies header modifications. Such B2BUA do use session timer for state maintenance. So, there are valid reasons for UA to state and to decrease the S-E expires value.

Regards,
_____________
Roman Shpount

---

From: Roman Shpount <[email-masked]>
Date: Sun, 7 Oct 2018 23:03:27 +0200

None of the elements including UA and Proxies should reduce SE refresh
interval without a good reason. Perhaps we should add language that all
elements should keep SE refresh value as large as possible to avoid network
overload.

Roman Shpount

On Sun, Oct 7, 2018, 9:19 PM Christer Holmberg <
[email-masked]> wrote:

>
> Fair enough, but I still think it would be good to have text saying that a
> UAS should not decrease the value unless it has a really good reason for
> doing so.
>
> Regards,
>
> Christer
>
> ------------------------------
> *From:* Roman Shpount <[email-masked]>
> *Sent:* Sunday, October 7, 2018 1:31 AM
> *To:* Christer Holmberg
> *Cc:* OKUMURA Shinji; SIPCORE; [email-masked]
> *Subject:* Re: [sipcore] Session-timer: Result below an acceptable value
>